li3p/preflight
skills/preflight/SKILL.md
Scan staged changes before commit for debug artifacts, secrets, skipped tests, generated files, and obvious code smells. Use when preparing a commit or checking whether staged changes are clean.
development
Updated Apr 23, 2026
$ install --global
skillsauthnpx skillsauth add li3p/skills preflightInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 23, 2026, 11:10 PM31.1s1 file scanned
SKILL.md
- name:
- preflight
- description:
- Scan staged changes before commit for debug artifacts, secrets, skipped tests, generated files, and obvious code smells. Use when preparing a commit or checking whether staged changes are clean.
Preflight
Review staged changes and report issues that should be fixed before committing.
Scope
Inspect staged diffs and staged file metadata. If relevant, also mention related unstaged issues separately so the user can distinguish blockers from follow-up work.
Checks
Look for:
- Debug output such as
console.log,print,pdb,breakpoint,debugger, or verbose flags in production paths. - Focused or skipped tests such as
.only,.skip,pytest.mark.skip, or commented-out test suites. - Hardcoded secrets, tokens, passwords, API keys, private keys, or connection strings.
TODO,FIXME,HACK,XXX, or unexplained suppressions.- Large binary files, generated files, dumps, lockfile surprises, or vendored artifacts.
- Commented-out code blocks and dead imports.
- Dev-only dependencies imported from production code paths.
- Risky behavior changes without nearby tests.
Output
If no issues are found, say the staged changes look clean.
If issues are found, group them as:
BLOCKER: likely to break production, leak data, or poison the commit.WARNING: risky or likely unintended.NOTE: worth checking but not necessarily blocking.
For each item, include file path, line or diff context, and why it matters. Report only. Do not edit files, unstage files, or commit.
Related Skills
li3p/notion-search
documentation
VerifiedTrustedCommunity
Search Notion for pages or databases by query using marknotion. Use when the user references a Notion page by name rather than URL, when locating a page to publish to or pull from, or when discovering what trackers and docs exist in the connected workspace.
SKILL.mdUpdated May 27, 2026
li3p/notion-pull
documentation
VerifiedTrustedCommunity
Export a Notion page to local Markdown using marknotion. Use when the user wants to pull a spec, design doc, meeting notes, or any Notion page into the repository as a Markdown file, or wants to read Notion content as context for a task.
SKILL.mdUpdated May 27, 2026
li3p/notion-publish
documentation
VerifiedTrustedCommunity
Publish a local Markdown file to a Notion page using marknotion. Use when the user wants to push README, docs, changelogs, or any Markdown content to Notion, either updating an existing page or creating a new one under a parent page.
SKILL.mdUpdated May 27, 2026
li3p/testmatch
testing
VerifiedTrustedCommunity
Generate tests that match an existing project's testing style. Use when adding coverage for a target file, function, bug fix, or edge case while preserving local conventions.
SKILL.mdUpdated Apr 23, 2026